fix(web): enforce sendPolicy on WhatsApp auto-reply delivery path by hydro13 · Pull Request #21893 · openclaw/openclaw

hydro13 · 2026-02-20T14:04:17Z

Summary

resolveSendPolicy() was being called in all outbound paths (commands, gateway chat, gateway agent) but was missing from the WhatsApp WebSocket inbound handler (process-message.ts). This meant sendPolicy config rules were silently bypassed for WhatsApp auto-replies.

Changes

src/web/auto-reply/monitor/process-message.ts

Import resolveSendPolicy from ../../../sessions/send-policy.js
Add policy check after echo detection, before ack reaction + dispatch
Channel hardcoded to 'whatsapp' (this file is WhatsApp-specific)
Returns false early when policy is 'deny', consistent with other paths

src/web/auto-reply/monitor/process-message.test.ts (new)

4 tests covering the send-policy gating:
1. Returns false and skips dispatch when sendPolicy denies the channel
2. Proceeds to dispatch when policy allows (rule targets different channel)
3. Proceeds to dispatch when no sendPolicy is configured
4. Denies group chat when rule targets whatsapp + chatType: group

Known Limitation

Per-session sendPolicy entry overrides (set directly on individual session entries in the store) are not checked in this path — process-message.ts does not load session entries. Config-level rules (channel, chatType, keyPrefix matching) work correctly. Per-session overrides can be added in a follow-up if needed.

Verification

npx tsc --noEmit   → 0 new errors (2 pre-existing upstream errors in gateway-server-chat-b.e2e.test.ts unchanged)
npx vitest run src/web/auto-reply/monitor/ src/sessions/send-policy → 13/13 passed

Greptile Summary

Adds missing sendPolicy enforcement to the WhatsApp auto-reply path (process-message.ts). The check is positioned after echo detection but before the ack reaction and reply dispatch, matching the gating pattern used in other outbound paths (commands, gateway chat, gateway agent). Hardcodes channel to 'whatsapp' since this handler is WhatsApp-specific. Test coverage validates all four policy scenarios: deny, allow (different channel rule), allow (no policy), and deny with chatType matching.

Confidence Score: 5/5

This PR is safe to merge with minimal risk
The change is a straightforward security fix that adds missing policy enforcement. The implementation follows existing patterns from other channels, the placement in the execution flow is correct (after echo detection, before dispatch), and comprehensive tests validate all policy scenarios. No breaking changes or regressions expected.
No files require special attention

_{Last reviewed commit: 4f3405c}

Glucksberg · 2026-02-21T19:56:22Z

Noticed a possible connection here.

PR #21827 by @rsuk-mb seems to address the same problem.

PR#21827 adds resolveSendPolicy enforcement to the WhatsApp on-message.ts handler, directly fixing the issue that sendPolicy rules are bypassed for WhatsApp auto-replies as reported in #21824.

Both approaches have merit — might be worth coordinating.

Related issue(s): #21824

If any of these links don't look right, let me know and I'll correct them.

rsuk-mb · 2026-02-21T22:16:47Z

Hey @hydro13 — we opened #21827 for the same issue before spotting this PR. After comparing the two, your approach of placing the check inside processMessage is cleaner: single insertion point, covers both broadcast and non-broadcast paths, and the chatType handling is slightly more correct (passing the raw value rather than normalizing non-group to undefined).

One minor suggestion: the resolveSendPolicy check currently runs after echo detection, store path resolution, envelope formatting, and session metadata reads (~lines 140-193). Moving it earlier in processMessage would skip that work when the policy denies — small perf win for denied sessions.

Happy to close #21827 in favour of this one.

@rsuk-mb

Skip store path, envelope, disk IO, group history, and echo detection for sessions where send policy denies. No logic change — same gate, earlier position. Addresses review suggestion from @rsuk-mb on openclaw#21893. Co-Authored-By: Claude Opus 4.6 <[email protected]>

@rsuk-mb

Skip store path, envelope, disk IO, group history, and echo detection for sessions where send policy denies. No logic change — same gate, earlier position. Addresses review suggestion from @rsuk-mb on openclaw#21893. Co-Authored-By: Claude Opus 4.6 <[email protected]>

hydro13 · 2026-02-21T23:03:36Z

Good catch @rsuk-mb — just pushed the early-exit. The resolveSendPolicy check is now the first thing in processMessage(), before store path resolution, envelope options, readSessionUpdatedAt (disk IO), group history, and echo detection.

Happy to close #21827 in favour of whichever the maintainers prefer.

@rsuk-mb

Skip store path, envelope, disk IO, group history, and echo detection for sessions where send policy denies. No logic change — same gate, earlier position. Addresses review suggestion from @rsuk-mb on openclaw#21893. Co-Authored-By: Claude Opus 4.6 <[email protected]>

hydro13 · 2026-02-22T01:26:15Z

Thanks @rsuk-mb — good catch on the ordering, and glad the approach looks solid.

Just to confirm: the check is already at the very top of processMessage in the current diff — before storePath, resolveEnvelopeFormatOptions, buildInboundLine, and echo detection. Denied sessions return immediately without touching any of that.

If you can close #21827 in favour of this one, that'd be great. Appreciate the thorough comparison.

@rsuk-mb

Skip store path, envelope, disk IO, group history, and echo detection for sessions where send policy denies. No logic change — same gate, earlier position. Addresses review suggestion from @rsuk-mb on openclaw#21893. Co-Authored-By: Claude Opus 4.6 <[email protected]>

…-pick) Cherry-pick of 49b1212 from fix/enforce-sendpolicy-whatsapp-autoreply. Temporary local patch until upstream openclaw#21893 merges. Co-Authored-By: Claude Opus 4.6 <[email protected]>

openclaw-barnacle · 2026-02-28T04:08:45Z

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

hydro13 · 2026-02-28T09:56:22Z

Rebased on current main.

hydro13 · 2026-03-02T14:49:06Z

Rebased on current main. Still relevant and ready for review.

hydro13 · 2026-03-13T09:26:57Z

Closing — fix landed in main via bfcde24 (fix(web): enforce sendPolicy on WhatsApp auto-reply delivery path). Superseded.

openclaw-barnacle bot added channel: whatsapp-web Channel integration: whatsapp-web size: M labels Feb 20, 2026

tristanmanchester mentioned this pull request Feb 21, 2026

WhatsApp: add lifecycle status reactions #22919

Open

18 tasks

rsuk-mb mentioned this pull request Feb 21, 2026

fix(whatsapp): enforce sendPolicy on auto-reply delivery path #21827

Closed

4 tasks

hydro13 force-pushed the fix/send-policy-whatsapp-inbound branch from 4f3405c to 2ed7f94 Compare February 21, 2026 23:00

openclaw-barnacle bot added the docs Improvements or additions to documentation label Feb 21, 2026

hydro13 force-pushed the fix/send-policy-whatsapp-inbound branch from 2ed7f94 to 9ca2ddf Compare February 21, 2026 23:00

hydro13 force-pushed the fix/send-policy-whatsapp-inbound branch from 9ca2ddf to 3429879 Compare February 21, 2026 23:06

openclaw-barnacle bot removed the docs Improvements or additions to documentation label Feb 21, 2026

hydro13 force-pushed the fix/send-policy-whatsapp-inbound branch from 3429879 to aa121b7 Compare February 22, 2026 01:26

openclaw-barnacle bot added the stale Marked as stale due to inactivity label Feb 28, 2026

fix(web): enforce sendPolicy on WhatsApp auto-reply delivery path

bfcde24

hydro13 force-pushed the fix/send-policy-whatsapp-inbound branch from aa121b7 to bfcde24 Compare February 28, 2026 09:56

openclaw-barnacle bot removed the stale Marked as stale due to inactivity label Mar 1, 2026

hydro13 mentioned this pull request Mar 3, 2026

docs(contributing): require before/after screenshots for UI PRs #32206

Merged

hydro13 closed this Mar 13, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(web): enforce sendPolicy on WhatsApp auto-reply delivery path#21893

fix(web): enforce sendPolicy on WhatsApp auto-reply delivery path#21893
hydro13 wants to merge 1 commit intoopenclaw:mainfrom
hydro13:fix/send-policy-whatsapp-inbound

hydro13 commented Feb 20, 2026 •

edited by greptile-apps bot

Loading

Uh oh!

Glucksberg commented Feb 21, 2026 •

edited

Loading

Uh oh!

rsuk-mb commented Feb 21, 2026

Uh oh!

hydro13 commented Feb 21, 2026

Uh oh!

hydro13 commented Feb 22, 2026

Uh oh!

openclaw-barnacle bot commented Feb 28, 2026

Uh oh!

hydro13 commented Feb 28, 2026

Uh oh!

hydro13 commented Mar 2, 2026

Uh oh!

hydro13 commented Mar 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

hydro13 commented Feb 20, 2026 • edited by greptile-apps bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Known Limitation

Verification

Greptile Summary

Confidence Score: 5/5

Uh oh!

Glucksberg commented Feb 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rsuk-mb commented Feb 21, 2026

Uh oh!

hydro13 commented Feb 21, 2026

Uh oh!

hydro13 commented Feb 22, 2026

Uh oh!

openclaw-barnacle bot commented Feb 28, 2026

Uh oh!

hydro13 commented Feb 28, 2026

Uh oh!

hydro13 commented Mar 2, 2026

Uh oh!

hydro13 commented Mar 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hydro13 commented Feb 20, 2026 •

edited by greptile-apps bot

Loading

Glucksberg commented Feb 21, 2026 •

edited

Loading